comisai 1.0.33 → 1.0.36

package/node_modules/@comis/agent/dist/model/oauth-credential-store-file.js

@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Plaintext file-backed OAuthCredentialStorePort adapter.
+ *
+ * Default storage backend for OAuth credentials (derives from existing
+ * dataDir, no separate config key). Stores all profiles in a single JSON
+ * file at ${dataDir}/auth-profiles.json with mode 0o600.
+ *
+ * Atomic write sequence (full POSIX crash safety on ext4):
+ *   write tmp 0o600 → fsync(tmpFd) → close(tmpFd) → rename(tmp, canonical)
+ *   → fsync(parentDirFd) → close(parentDirFd)
+ *
+ * cron-store.ts does NOT fsync the parent directory; this adapter MUST
+ * because OAuth credentials are security-critical (a lost rename due to
+ * power-loss-after-data-write would silently log the user out).
+ *
+ * Per-profile-ID locking via withExecutionLock: different providers and
+ * different identities for the same provider can refresh in parallel.
+ *
+ * Schema versioning: single integer version at top level. Hard-fail on
+ * mismatch — pre-1.0 software, no migration plumbing.
+ *
+ * @module
+ */
+import * as fs from "node:fs/promises";
+import { ok, err, fromPromise, suppressError } from "@comis/shared";
+import { safePath } from "@comis/core";
+import { validateProfileId, } from "@comis/core";
+import { withExecutionLock } from "@comis/scheduler";
+const SCHEMA_VERSION = 1;
+const FILE_NAME = "auth-profiles.json";
+const LOCKS_SUBDIR = ".locks";
+const LOCK_OPTIONS = { staleMs: 30_000, updateMs: 5_000 };
+/**
+ * Per-profile in-process serialization queue.
+ *
+ * `withExecutionLock` uses `retries: 0` so two concurrent same-profile writes
+ * within the SAME Node process would race the cross-process file lock and the
+ * second caller would get `err("locked")`. The in-process mutex serializes
+ * same-profile writes BEFORE they reach the file lock — different profiles
+ * still proceed in parallel (each gets its own queue), preserving per-profile
+ * lock granularity. Mirrors cron-store.ts:181.
+ */
+function createPerProfileMutex() {
+    const chains = new Map();
+    return {
+        serialize(profileId, fn) {
+            const prior = chains.get(profileId) ?? Promise.resolve();
+            const next = prior.then(fn, fn);
+            // Swallow rejections in the chain so subsequent serialize() calls keep running.
+            chains.set(profileId, next.then(() => undefined, () => undefined));
+            return next;
+        },
+    };
+}
+/**
+ * Sanitize a profile-ID for safe inclusion in a lock-file path.
+ * One-way transformation, lock-file name only — the canonical profile-ID
+ * stored in the JSON file keeps its original form.
+ *
+ * Mappings: ":" → "__", "@" → "_at_".
+ */
+function sanitizeProfileIdForLockPath(profileId) {
+    return profileId.replace(/:/g, "__").replace(/@/g, "_at_");
+}
+function lockSentinelPath(dataDir, profileId) {
+    return safePath(dataDir, LOCKS_SUBDIR, "auth-profile__" + sanitizeProfileIdForLockPath(profileId) + ".lock");
+}
+function authProfilesFilePath(dataDir) {
+    return safePath(dataDir, FILE_NAME);
+}
+/**
+ * Atomic write with parent-dir fsync.
+ * Sequence: write tmp 0o600 → fsync(tmp) → close(tmp) → rename(tmp, canonical)
+ *           → fsync(parentDir) → close(parentDir).
+ *
+ * Tmp filename includes pid + random suffix so concurrent writes (different
+ * profile-IDs holding different per-profile locks) don't race on the same
+ * tmp path. Mirrors cron-store.ts:103.
+ */
+async function atomicWriteJson(canonicalPath, parentDir, data) {
+    const tmpPath = canonicalPath + "." + String(process.pid) + "." + Math.random().toString(16).slice(2) + ".tmp";
+    await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), {
+        encoding: "utf-8",
+        mode: 0o600,
+    });
+    const tmpFd = await fs.open(tmpPath, "r");
+    try {
+        await tmpFd.sync();
+    }
+    finally {
+        await tmpFd.close();
+    }
+    await fs.rename(tmpPath, canonicalPath);
+    const dirFd = await fs.open(parentDir, "r");
+    try {
+        await dirFd.sync();
+    }
+    finally {
+        await dirFd.close();
+    }
+}
+/**
+ * Load the auth-profiles file. Hard-fails on schema-version mismatch.
+ * ENOENT → returns ok({ version: 1, profiles: {} }) (empty store).
+ */
+async function loadAuthProfiles(filePath) {
+    return fromPromise((async () => {
+        let raw;
+        try {
+            raw = await fs.readFile(filePath, "utf-8");
+        }
+        catch (e) {
+            if (e !== null &&
+                typeof e === "object" &&
+                "code" in e &&
+                e.code === "ENOENT") {
+                return { version: SCHEMA_VERSION, profiles: {} };
+            }
+            throw e;
+        }
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("auth-profiles.json: malformed (expected object). Hint: Delete " +
+                filePath +
+                " and re-login to recreate.");
+        }
+        const obj = parsed;
+        const version = obj.version;
+        if (version !== SCHEMA_VERSION) {
+            throw new Error("OAuth profile store version mismatch: expected " +
+                SCHEMA_VERSION +
+                ", got " +
+                String(version) +
+                ". Hint: Delete " +
+                filePath +
+                " and re-run `comis auth login` to recreate the profile. Stored profiles for unknown schema versions cannot be migrated.");
+        }
+        const profilesRaw = obj.profiles;
+        if (profilesRaw === null ||
+            typeof profilesRaw !== "object" ||
+            Array.isArray(profilesRaw)) {
+            throw new Error("auth-profiles.json: profiles field malformed. Hint: Delete " +
+                filePath +
+                " and re-login.");
+        }
+        return {
+            version,
+            profiles: profilesRaw,
+        };
+    })());
+}
+/**
+ * Cleanup orphaned *.tmp files from previous crashed writes (hygiene).
+ * Best-effort — failures are silent; this is housekeeping, not correctness.
+ */
+async function cleanupStaleTmpFiles(parentDir) {
+    try {
+        const entries = await fs.readdir(parentDir);
+        const tmpFiles = entries.filter((n) => n.startsWith(FILE_NAME) && n.endsWith(".tmp"));
+        for (const name of tmpFiles) {
+            try {
+                await fs.unlink(safePath(parentDir, name));
+            }
+            catch {
+                // best-effort cleanup
+            }
+        }
+    }
+    catch {
+        // dir may not exist yet
+    }
+}
+/**
+ * Create a plaintext file-backed OAuthCredentialStorePort adapter.
+ *
+ * Atomic, lock-protected, version-validated. Lifecycle:
+ * - On factory call: ensures dataDir exists (mkdir 0o700 recursive); cleans up stale .tmp files.
+ * - On every set/delete: per-profile-ID file lock → load → mutate → atomic-write.
+ * - On every get/has/list: load (no lock — readers see snapshot per POSIX rename atomicity).
+ */
+export function createOAuthCredentialStoreFile(config) {
+    const { dataDir } = config;
+    const filePath = authProfilesFilePath(dataDir);
+    const parentDir = dataDir;
+    const mutex = createPerProfileMutex();
+    // Best-effort startup hygiene — do not block factory return.
+    suppressError(cleanupStaleTmpFiles(parentDir), "oauth-credential-store-file: stale .tmp cleanup");
+    async function ensureParentDir() {
+        await fs.mkdir(parentDir, { recursive: true, mode: 0o700 });
+    }
+    const port = {
+        async get(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            const loadRes = await loadAuthProfiles(filePath);
+            if (!loadRes.ok)
+                return err(loadRes.error);
+            return ok(loadRes.value.profiles[profileId]);
+        },
+        async set(profileId, profile) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            await ensureParentDir();
+            const lockPath = lockSentinelPath(dataDir, profileId);
+            return mutex.serialize(profileId, async () => {
+                const lockResult = await withExecutionLock(lockPath, async () => {
+                    const loadRes = await loadAuthProfiles(filePath);
+                    if (!loadRes.ok)
+                        throw loadRes.error;
+                    const data = loadRes.value;
+                    data.profiles[profileId] = {
+                        ...profile,
+                        profileId,
+                        version: SCHEMA_VERSION,
+                    };
+                    await atomicWriteJson(filePath, parentDir, data);
+                }, LOCK_OPTIONS);
+                if (!lockResult.ok) {
+                    return err(new Error("OAuth file adapter set(" +
+                        profileId +
+                        ") failed: lock " +
+                        lockResult.error));
+                }
+                return ok(undefined);
+            });
+        },
+        async delete(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            await ensureParentDir();
+            const lockPath = lockSentinelPath(dataDir, profileId);
+            return mutex.serialize(profileId, async () => {
+                let deleted = false;
+                const lockResult = await withExecutionLock(lockPath, async () => {
+                    const loadRes = await loadAuthProfiles(filePath);
+                    if (!loadRes.ok)
+                        throw loadRes.error;
+                    const data = loadRes.value;
+                    if (profileId in data.profiles) {
+                        delete data.profiles[profileId];
+                        deleted = true;
+                        await atomicWriteJson(filePath, parentDir, data);
+                    }
+                }, LOCK_OPTIONS);
+                if (!lockResult.ok) {
+                    return err(new Error("OAuth file adapter delete(" +
+                        profileId +
+                        ") failed: lock " +
+                        lockResult.error));
+                }
+                return ok(deleted);
+            });
+        },
+        async list(filter) {
+            const loadRes = await loadAuthProfiles(filePath);
+            if (!loadRes.ok)
+                return err(loadRes.error);
+            const all = Object.values(loadRes.value.profiles);
+            if (filter?.provider) {
+                return ok(all.filter((p) => p.provider === filter.provider));
+            }
+            return ok(all);
+        },
+        async has(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            const loadRes = await loadAuthProfiles(filePath);
+            if (!loadRes.ok)
+                return err(loadRes.error);
+            return ok(profileId in loadRes.value.profiles);
+        },
+    };
+    return Object.freeze(port);
+}

package/node_modules/@comis/agent/dist/model/oauth-credential-store-selector.d.ts

@@ -0,0 +1,49 @@
+/**
+ * OAuth credential store selector.
+ *
+ * The CLI process needs to instantiate the same adapter the daemon uses, but
+ * @comis/cli cannot import from @comis/daemon (dep direction). Daemon and CLI
+ * both consume from @comis/agent.
+ *
+ * Throws (NOT a Result — daemon bootstrap is a synchronous trust boundary
+ * where fail-fast is the right policy) when:
+ *  - storage === "encrypted" AND either secretsCrypto or secretsDb is missing
+ *    (operator forgot to set SECRETS_MASTER_KEY but selected encrypted mode)
+ *
+ * For the encrypted branch the adapter SHARES the supplied secretsDb handle —
+ * a single connection serves both `secrets` and `oauth_profiles` tables in the
+ * same file.
+ *
+ * @module
+ */
+import type Database from "better-sqlite3";
+import type { SecretsCrypto, OAuthCredentialStorePort } from "@comis/core";
+import { createOAuthProfileStoreEncrypted } from "@comis/memory";
+import { createOAuthCredentialStoreFile } from "./oauth-credential-store-file.js";
+/** Storage backend selector from `appConfig.oauth.storage`. */
+export type OAuthStorageMode = "file" | "encrypted";
+/**
+ * Inputs for selectOAuthCredentialStore. Extracted to a typed shape so the
+ * helper can be unit-tested without spinning up a full setupSingleAgent path.
+ */
+export interface SelectOAuthCredentialStoreInput {
+    /** Storage backend selector from `appConfig.oauth.storage`. */
+    storage: OAuthStorageMode;
+    /** Absolute data directory (e.g. ~/.comis). Constructed via `safePath` upstream. */
+    dataDir: string;
+    /** Optional SecretsCrypto engine — REQUIRED when storage === "encrypted". */
+    secretsCrypto?: SecretsCrypto;
+    /** Optional shared better-sqlite3 handle — REQUIRED when storage === "encrypted". */
+    secretsDb?: Database.Database;
+    /** Optional injection points for unit tests (defaults to the real factories). */
+    factories?: {
+        file?: typeof createOAuthCredentialStoreFile;
+        encrypted?: typeof createOAuthProfileStoreEncrypted;
+    };
+}
+/**
+ * Select and instantiate the right OAuthCredentialStorePort adapter from
+ * `appConfig.oauth.storage`. Used by both the daemon (setup-agents.ts) and
+ * the CLI commands (`comis auth login/list/logout/status`).
+ */
+export declare function selectOAuthCredentialStore(input: SelectOAuthCredentialStoreInput): OAuthCredentialStorePort;

package/node_modules/@comis/agent/dist/model/oauth-credential-store-selector.js

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth credential store selector.
+ *
+ * The CLI process needs to instantiate the same adapter the daemon uses, but
+ * @comis/cli cannot import from @comis/daemon (dep direction). Daemon and CLI
+ * both consume from @comis/agent.
+ *
+ * Throws (NOT a Result — daemon bootstrap is a synchronous trust boundary
+ * where fail-fast is the right policy) when:
+ *  - storage === "encrypted" AND either secretsCrypto or secretsDb is missing
+ *    (operator forgot to set SECRETS_MASTER_KEY but selected encrypted mode)
+ *
+ * For the encrypted branch the adapter SHARES the supplied secretsDb handle —
+ * a single connection serves both `secrets` and `oauth_profiles` tables in the
+ * same file.
+ *
+ * @module
+ */
+import { createOAuthProfileStoreEncrypted } from "@comis/memory";
+import { createOAuthCredentialStoreFile } from "./oauth-credential-store-file.js";
+/**
+ * Select and instantiate the right OAuthCredentialStorePort adapter from
+ * `appConfig.oauth.storage`. Used by both the daemon (setup-agents.ts) and
+ * the CLI commands (`comis auth login/list/logout/status`).
+ */
+export function selectOAuthCredentialStore(input) {
+    const { storage, dataDir, secretsCrypto, secretsDb, factories } = input;
+    const fileFactory = factories?.file ?? createOAuthCredentialStoreFile;
+    const encryptedFactory = factories?.encrypted ?? createOAuthProfileStoreEncrypted;
+    if (storage === "encrypted") {
+        // Bootstrap precondition: encrypted-mode requires BOTH a SecretsCrypto
+        // engine and the shared secrets.db handle. No silent fallback to file
+        // mode — fail fast with operator hint.
+        if (!secretsCrypto || !secretsDb) {
+            throw new Error("OAuth storage mode is 'encrypted' but the secrets DB / crypto engine " +
+                "is not initialized. Hint: set SECRETS_MASTER_KEY env var (and restart " +
+                "the daemon) so the encrypted secrets store boots, or change " +
+                "appConfig.oauth.storage to 'file' to use the plaintext file backend.");
+        }
+        // SHARE the existing better-sqlite3 connection from createSqliteSecretStore
+        // (NOT a second handle to the same file). initOAuthProfileSchema (called
+        // inside createOAuthProfileStoreEncrypted) is idempotent (CREATE TABLE IF
+        // NOT EXISTS), so it's safe to call from this adapter on a db that already
+        // has the secrets table.
+        return encryptedFactory(secretsDb, secretsCrypto);
+    }
+    // Default: plaintext file-backed adapter at ${dataDir}/auth-profiles.json.
+    return fileFactory({ dataDir });
+}

package/node_modules/@comis/agent/dist/model/oauth-device-code.d.ts

@@ -0,0 +1,57 @@
+/**
+ * OAuth device-code login for OpenAI Codex.
+ *
+ * Port of the upstream device-code reference module with Comis-specific
+ * adaptations:
+ *   1. ORIGINATOR header is the literal "comis".
+ *   2. The cosmetic version-header lookup is DROPPED — header is
+ *      informational; CLAUDE.md forbids reading runtime env in library code.
+ *   3. trimNonEmptyString is INLINE (3-line helper) per AGENTS.md §2.3.
+ *   4. resolveCodexAccessTokenExpiry is imported from Comis's
+ *      oauth-identity.ts module (same signature as the upstream variant).
+ *   5. Public boundary returns Result<T,E> per AGENTS.md §2.1 — internal
+ *      helpers still throw, but the top-level loginOpenAICodexDeviceCode
+ *      wraps everything in try/catch + rewriteOAuthError + narrowing.
+ *
+ * Protocol: OpenAI's proprietary 3-step device-code flow (NOT RFC 8628):
+ *   1. POST /api/accounts/deviceauth/usercode -> device_auth_id + user_code
+ *   2. Poll POST /api/accounts/deviceauth/token (403/404 = pending, 200 =
+ *      authorization_code + code_verifier; verifier comes FROM the server)
+ *   3. POST /oauth/token grant_type=authorization_code -> tokens
+ *
+ * This module never logs — the caller (oauth-login-runner.ts) is responsible
+ * for surfacing progress via prompter.log.info / Pino. Per AGENTS.md §2.4 no
+ * logger import.
+ *
+ * @module
+ */
+import type { Result } from "@comis/shared";
+import type { LoginError } from "./oauth-login-runner.js";
+/** The verification prompt surfaced to the caller — userCode + URL the user types/visits on phone. */
+export interface DeviceCodeVerificationPrompt {
+    verificationUrl: string;
+    userCode: string;
+    expiresInMs: number;
+}
+/** Options / DI seams for loginOpenAICodexDeviceCode. */
+export interface LoginOpenAICodexDeviceCodeOptions {
+    /** Dependency-injected fetch — defaults to globalThis.fetch. Used by tests. */
+    fetchFn?: typeof fetch;
+    /** Called once when userCode + verificationUrl are known. */
+    onVerification: (prompt: DeviceCodeVerificationPrompt) => Promise<void> | void;
+    /** Optional progress callback fired with stage strings during the flow. */
+    onProgress?: (message: string) => void;
+}
+/**
+ * Run the OpenAI Codex device-code flow end-to-end.
+ *
+ * Returns ok({ access, refresh, expires }) on success, err({ code, message,
+ * hint }) on failure. NEVER throws — internal helpers throw, the boundary
+ * wraps everything in try/catch and pipes through rewriteOAuthError +
+ * narrowToLoginError.
+ */
+export declare function loginOpenAICodexDeviceCode(params: LoginOpenAICodexDeviceCodeOptions): Promise<Result<{
+    access: string;
+    refresh: string;
+    expires: number;
+}, LoginError>>;